Skip to content

chore(upstream-sync): improve workflow and prompt handling #12

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Mearman merged 5 commits into from
Feb 16, 2026
Merged

chore(upstream-sync): improve workflow and prompt handling #12

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
1d688b0
fix(upstream-sync): allow shell utilities in Claude Code allowed tools
Mearman Feb 16, 2026
cba8bd8
feat(upstream-sync): extract sync prompt into dedicated prompt file
Mearman Feb 16, 2026
7d8af64
refactor(upstream-sync): use own composite action instead of upstream
Mearman Feb 16, 2026
2c6a547
fix(upstream-sync): improve upstream reference section in PR template
Mearman Feb 16, 2026
e374429
fix(upstream-sync): specify release.json field names in prompt
Mearman Feb 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
102 changes: 102 additions & 0 deletions .github/prompts/upstream-sync/01-sync-task.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,102 @@
You are performing an automated upstream sync for a composite GitHub Action
that wraps `anthropics/claude-code-action@v1`.

Ignore any shared prompt instructions about PR reviews, pending reviews, comment
hygiene, or cleanup steps — those do not apply to this task.

## Your task

Compare our wrapper action against the upstream action and update our files
to reflect any new, changed, or removed inputs/outputs.

## Files to read

1. `./action.yml` — our composite wrapper action
2. `./README.md` — our documentation
3. `/tmp/upstream/action.yml` — upstream action definition
4. `/tmp/upstream/README.md` — upstream documentation
5. `/tmp/upstream/release.json` — latest upstream release info
6. `/tmp/upstream/commits.json` — recent upstream commits

## What to compare

- **Inputs**: Every input in upstream's `action.yml` that we pass through
(i.e., appears in our `with:` block under "Run Claude Code"). Check for:
- New upstream inputs not yet in our `action.yml` → add them
- Removed upstream inputs still in our `action.yml` → remove them
- Changed descriptions or defaults → update ours to match
- **Outputs**: Every output in upstream's `action.yml`. Check for:
- New outputs → add pass-through in our `outputs:` section
- Removed outputs → remove from ours
- **README.md tables**: The "Action Inputs" and "Action Outputs" tables
must match what's in our `action.yml` after updates.

## Rules

- Preserve our existing code style, comments, and section organisation.
- Preserve dual-org compatibility: never hardcode org names — use
`YOUR_ORG` in README examples and `$REPO_OWNER` in prompt files.
- Do NOT touch any files in `prompts/` — those are org-specific.
- Do NOT touch `.github/workflows/claude-interactive.yml` or
`.github/workflows/claude-review.yml` — those are consumer-facing.
- Do NOT modify `.github/workflows/upstream-sync.yml` (this workflow).
- Maintain the grouping comments in `action.yml` (e.g., `# Progress tracking`,
`# Triggers`, `# Branch settings`, etc.).
- For new inputs: place them in a logical group, matching upstream's order
where possible. Add them to the `with:` block in the "Run Claude Code" step.
- Keep our custom inputs (`mode`, `prompt_dir`, `pr_number`) that don't exist
upstream — these are part of our wrapper's API.

## After making changes

If you made any meaningful changes:

@claude claude Bot Feb 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The prompt instructs the agent to compute date +%Y%m%d at runtime, but the workflow previously pre-computed this value in steps.fetch.outputs.sync_date. Now that the workflow no longer provides this value, the agent must compute it during execution.

This works, but it introduces a race condition: if the workflow starts just before midnight and the agent runs just after, the branch name won't match what was intended. The previous approach (pre-computing in the workflow) was more deterministic.

Consider either:

  1. Restoring the pre-computed date in the workflow, or
  2. Documenting this edge case in the prompt

1. Ensure the `upstream-sync` label exists (idempotent):
`gh label create upstream-sync --description "Automated upstream sync" --color "0E8A16" --force`
2. Determine today's date in YYYYMMDD format using `date +%Y%m%d`.
3. Create a new branch: `claude/upstream-sync-<YYYYMMDD>`
4. Stage and commit changes with message:
`chore: sync with upstream anthropics/claude-code-action`
5. Push the branch:
`git push origin claude/upstream-sync-<YYYYMMDD>`
6. Create a PR with:

```bash
gh pr create \
--title "chore: sync with upstream anthropics/claude-code-action" \
--body "Automated sync of inputs, outputs, and documentation with upstream anthropics/claude-code-action.

## Changes

<summarise what changed>

## Upstream reference

From release.json, extract `.tag_name` (e.g. v1.0.52) and
`.published_at` for the date. Note: the v1 tag is a rolling tag that
tracks the latest patch release. Present both clearly, e.g.:

- **Patch version**: [v1.0.52](https://github.com/anthropics/claude-code-action/releases/tag/v1.0.52) (2026-02-15)
- **Rolling tag**: [v1](https://github.com/anthropics/claude-code-action/releases/tag/v1)
- [All releases](https://github.com/anthropics/claude-code-action/releases)

---
*Created automatically by the upstream-sync workflow.*" \
--label "upstream-sync"
```

If there are NO meaningful changes (our action already reflects upstream),
do nothing — no branch, no commit, no PR. Just state that everything is
in sync.

## Reporting tool use issues

If any tool call is denied due to permission restrictions, report every
occurrence clearly in your final output. For each denied call, state:

- The tool name and the command you tried to run
- Why you needed it
- How you worked around it (or that you could not)

This information helps maintainers keep the `--allowedTools` list up to
date. Do not silently skip denied operations.
88 changes: 3 additions & 85 deletions .github/workflows/upstream-sync.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -61,96 +61,14 @@ jobs:
gh api 'repos/anthropics/claude-code-action/commits?per_page=30' \
> /tmp/upstream/commits.json

# Pre-compute date for consistent branch naming
echo "sync_date=$(date +%Y%m%d)" >> "$GITHUB_OUTPUT"

echo "::notice::Upstream context fetched successfully."

- name: Run Claude Code for sync analysis
if: steps.guard.outputs.skip != 'true'
uses: anthropics/claude-code-action@v1
uses: ./

@claude claude Bot Feb 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

uses: ./ invokes the composite action from the current repository instead of calling upstream directly.

This changes the behavior significantly:

  • Previous: called anthropics/claude-code-action@v1 directly with an inline prompt
  • Now: calls the wrapper action with prompt_dir: upstream-sync

The wrapper action's prompt composition step (action.yml:176-232) will look for prompts in .github/prompts/upstream-sync/*.md relative to the action path (${{ github.action_path }}), which when uses: ./ is specified, points to the repo root.

Verify that the prompt composition correctly resolves .github/prompts/upstream-sync/01-sync-task.md when invoked this way.

with:
claude_code_oauth_token: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}
prompt: |
You are performing an automated upstream sync for a composite GitHub Action
that wraps `anthropics/claude-code-action@v1`.

## Your task

Compare our wrapper action against the upstream action and update our files
to reflect any new, changed, or removed inputs/outputs.

## Files to read

1. `./action.yml` — our composite wrapper action
2. `./README.md` — our documentation
3. `/tmp/upstream/action.yml` — upstream action definition
4. `/tmp/upstream/README.md` — upstream documentation
5. `/tmp/upstream/release.json` — latest upstream release info
6. `/tmp/upstream/commits.json` — recent upstream commits

## What to compare

- **Inputs**: Every input in upstream's `action.yml` that we pass through
(i.e., appears in our `with:` block under "Run Claude Code"). Check for:
- New upstream inputs not yet in our `action.yml` → add them
- Removed upstream inputs still in our `action.yml` → remove them
- Changed descriptions or defaults → update ours to match
- **Outputs**: Every output in upstream's `action.yml`. Check for:
- New outputs → add pass-through in our `outputs:` section
- Removed outputs → remove from ours
- **README.md tables**: The "Action Inputs" and "Action Outputs" tables
must match what's in our `action.yml` after updates.

## Rules

- Preserve our existing code style, comments, and section organization.
- Preserve dual-org compatibility: never hardcode org names — use
`YOUR_ORG` in README examples and `$REPO_OWNER` in prompt files.
- Do NOT touch any files in `prompts/` — those are org-specific.
- Do NOT touch `.github/workflows/claude-interactive.yml` or
`.github/workflows/claude-review.yml` — those are consumer-facing.
- Do NOT modify `.github/workflows/upstream-sync.yml` (this workflow).
- Maintain the grouping comments in `action.yml` (e.g., `# Progress tracking`,
`# Triggers`, `# Branch settings`, etc.).
- For new inputs: place them in a logical group, matching upstream's order
where possible. Add them to the `with:` block in the "Run Claude Code" step.
- Keep our custom inputs (`mode`, `prompt_dir`, `pr_number`) that don't exist
upstream — these are part of our wrapper's API.

## After making changes

If you made any meaningful changes:

1. Ensure the `upstream-sync` label exists (idempotent):
`gh label create upstream-sync --description "Automated upstream sync" --color "0E8A16" --force`
2. Create a new branch: `claude/upstream-sync-${{ steps.fetch.outputs.sync_date }}`
3. Stage and commit changes with message:
`chore: sync with upstream anthropics/claude-code-action`
4. Push the branch:
`git push origin claude/upstream-sync-${{ steps.fetch.outputs.sync_date }}`
5. Create a PR with:
```
gh pr create \
--title "chore: sync with upstream anthropics/claude-code-action" \
--body "Automated sync of inputs, outputs, and documentation with upstream anthropics/claude-code-action.

## Changes

<summarize what changed>

## Upstream reference

<include latest release tag and date from release.json>

---
*Created automatically by the upstream-sync workflow.*" \
--label "upstream-sync"
```

If there are NO meaningful changes (our action already reflects upstream),
do nothing — no branch, no commit, no PR. Just state that everything is
in sync.
prompt_dir: upstream-sync
claude_args: >-

@claude claude Bot Feb 16, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The allowed tools list adds several bash commands (cat, sort, comm, diff, echo, grep, date), but the prompt instructs the agent to avoid these in favor of specialized tools.

From CLAUDE.md prompts:

"Avoid using Bash with the find, grep, cat, head, tail, sed, awk, or echo commands... Instead, always prefer using the dedicated tools"

The upstream-sync prompt doesn't override this guidance. Consider whether these bash commands are actually needed for the sync task, or if the agent can use Read, Grep, etc. instead.

--max-turns 50
--allowedTools "Read,Write,Edit,Glob,Grep,Bash(git:*),Bash(gh pr create:*),Bash(gh label create:*)"
--allowedTools "Read,Write,Edit,Glob,Grep,Bash(git:*),Bash(gh pr create:*),Bash(gh label create:*),Bash(cat:*),Bash(sort:*),Bash(comm:*),Bash(diff:*),Bash(echo:*),Bash(grep:*),Bash(date:*)"
Loading